TI-2013-01869 Aliases CVE-2013-2100 GHSA-8823-xphr-qw9v

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using…

MEDIUM 43CWE-310Published 2014-09-29 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

Why it matters now

EPSS 0.0157 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed portage (PyPI): 2.1.12.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	portage (PyPI)	before 2.1.12.2	2.1.12.2	Patch available	GHSA-8823-xphr-qw9v

— Vendor— Affected all versions Fixed in — No fix listed CNA
portage (PyPI) Vendor— Affected before 2.1.12.2 Fixed in 2.1.12.2 Patch available GHSA-8823-xphr-qw9v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gentoo:portage:2.1.12:::::::*	2.1.12	Vulnerable	gentoo

cpe:2.3:a:gentoo:portage:2.1.12:*:*:*:*:*:*:* Versions 2.1.12 Vulnerable ·gentoo

Remediation

Fix · GHSA-8823-xphr-qw9v portage (PyPI) Fixed in 2.1.12.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2013-2100
2026-10-03 Alias added: GHSA-8823-xphr-qw9v

References

Exploit 1

[oss-security] 20130515 CVE Request: Man in the middle on Gentoo Portage binary package installer

Patch 1

https://bugs.gentoo.org/show_bug.cgi?id=469888

Advisory 2

Other 3

TI-2016-09197 In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the… CVSS 3.1CRITICAL 9.8
TI-2004-02643 Ebuild in Gentoo may change directory and file permissions depending on the order of… CVSS 3.0HIGH 7.1
TI-2008-04191 Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the… CVSS 2.0MEDIUM 6.9
TI-2004-01775 Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles. CVSS 3.1MEDIUM 5.5
TI-2019-14618 Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the… CVSS 3.1MEDIUM 5.5
TI-2007-05962 etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences